{"id":810,"date":"2026-09-28T02:07:56","date_gmt":"2026-09-28T02:07:56","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=810"},"modified":"2026-09-28T02:07:56","modified_gmt":"2026-09-28T02:07:56","slug":"iis-http2-http3-windows-server-enablement","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/","title":{"rendered":"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">HTTP\/2 is enabled by default on Windows Server 2016 and later, but HTTP\/3 is not, and both need specific registry keys to behave correctly behind a proxy or load balancer. This guide covers enabling HTTP\/3 over QUIC on IIS, verifying HTTP\/2 is actually negotiating, and the TLS cipher suites that must be present for either to work.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites and version support<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Windows Server<\/th><th>HTTP\/2<\/th><th>HTTP\/3 (QUIC)<\/th><th>Notes<\/th><\/tr><\/thead><tbody><tr><td>2016<\/td><td>Yes, on by default<\/td><td>No<\/td><td>Needs TLS 1.2+ ciphers<\/td><\/tr><tr><td>2019<\/td><td>Yes<\/td><td>No<\/td><td>Registry tuning available<\/td><\/tr><tr><td>2022<\/td><td>Yes<\/td><td>Yes (build 20348+)<\/td><td>Enable via registry, IIS 10<\/td><\/tr><tr><td>2025<\/td><td>Yes<\/td><td>Yes<\/td><td>Best QUIC support, HTTP.sys native<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">HTTP\/2 requires HTTPS\/TLS in practice \u2014 browsers will not negotiate h2 over cleartext, with one exception for h2c that IIS does not use. So TLS must be correct first. If HTTPS is not yet working, start with the <a href=\"https:\/\/windows-vps.org\/blog\/iis-https-setup-bindings-certificates\/\">IIS HTTPS bindings and certificates guide<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: confirm HTTP\/2 in the registry<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HTTP\/2 settings live under HTTP.sys, not in IIS. Check the current state and set them explicitly.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Inspect HTTP\/2 parameters (HTTP.sys)\n$base = 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\HTTP\\Parameters'\nGet-ItemProperty -Path $base |\n  Select-Object EnableHttp2Tls, EnableHttp2Cleartext, Http2MaxSettingsPerFrame, Http2MaxSettingsPerMinute\n\n# Enable HTTP\/2 over TLS (default 1 on modern builds)\nSet-ItemProperty -Path $base -Name EnableHttp2Tls -Value 1 -Type DWord\nSet-ItemProperty -Path $base -Name EnableHttp2Cleartext -Value 0 -Type DWord\n\n# Restart HTTP.sys\nnet stop http \/y\nnet start http\niisreset \/restart<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Inside IIS Manager, each site also has per-binding HTTP\/2 control under the site&#8217;s Bindings node \u2014 the &#8220;Disable HTTP\/2&#8221; checkbox. Leave it unchecked unless a specific backend app breaks on h2 stream multiplexing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: enable HTTP\/3 over QUIC<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">QUIC runs over UDP 443, which means a completely different firewall consideration from the TCP 443 you already have open. Two things must be true: the registry keys below, and UDP 443 allowed inbound.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Enable HTTP\/3 over QUIC (Windows Server 2022 build 20348+ \/ 2025)\n$base = 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\HTTP\\Parameters'\nSet-ItemProperty -Path $base -Name EnableHttp3 -Value 1 -Type DWord\nSet-ItemProperty -Path $base -Name EnableQuic -Value 1 -Type DWord\n\n# Allow QUIC through the firewall\nNew-NetFirewallRule -DisplayName \"IIS HTTP\/3 QUIC (UDP 443)\" `\n  -Direction Inbound -Protocol UDP -LocalPort 443 -Action Allow -Profile Any\n\nRestart-Service http -Force<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>HTTP\/3 is only negotiated after a browser has connected once over HTTP\/2 \u2014 the Alt-Svc header tells it to try QUIC on the next request. Do not expect h3 on a cold first load.<\/li><li>If your VPS provider filters UDP, HTTP\/3 will silently fall back to HTTP\/2. Verify with a packet-level or dev-tools check rather than assuming.<\/li><li>Application Request Routing (ARR) and some WAF modules do not fully support QUIC; test reverse-proxy paths separately.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: the cipher suites both protocols require<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HTTP\/2&#8217;s RFC forbids cipher suites that browsers consider obsolete, and QUIC requires TLS 1.3 with AES-GCM or ChaCha20. If you removed TLS 1.3 or trimmed cipher suites too aggressively, HTTP\/2 negotiation fails and browsers fall back to HTTP\/1.1 without any obvious error. Confirm the state:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Check TLS 1.2\/1.3 and cipher suite order\nGet-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.2\\Server' -ErrorAction SilentlyContinue\nGet-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.3\\Server' -ErrorAction SilentlyContinue\nGet-TlsCipherSuite | Where-Object Name -match 'AES_GCM|CHACHA20' |\n  Select-Object Name, CipherSuitePosition<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Verifying what the server actually negotiates<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Server-side headers are not enough \u2014 you need to see the negotiated protocol. From a Windows box with the same TLS stack, use a quick TLS handshake probe, or from any machine use curl if available:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># From Linux\/macOS or WSL: show negotiated protocol version\ncurl -sI --http2 https:\/\/example.com\/ | head -1\n\n# Confirm h3 is advertised\ncurl -sI https:\/\/example.com\/ | Select-String -Pattern 'alt-svc'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In Chrome or Edge, open DevTools, go to Network, enable the Protocol column, and reload. You should see <code>h2<\/code> for most requests and <code>h3<\/code> once QUIC has been learned. If you only ever see <code>http\/1.1<\/code>, the cause is almost always a missing TLS cipher or a TLS 1.2 minimum that your scanner report told you to set but that also removed the required AEAD suites.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Performance impact and when HTTP\/3 is worth it<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HTTP\/3 pays off most for clients on lossy or high-latency links. Because QUIC replaces TCP&#8217;s head-of-line blocking with per-stream delivery, a single dropped packet no longer stalls every other request on the connection. On a clean low-latency LAN the gain is close to zero, which is why enabling it and measuring is the only honest approach.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Scenario<\/th><th>HTTP\/2<\/th><th>HTTP\/3<\/th><th>Verdict<\/th><\/tr><\/thead><tbody><tr><td>Many small assets, low latency<\/td><td>Excellent<\/td><td>Equivalent<\/td><td>No measurable gain<\/td><\/tr><tr><td>Mobile \/ lossy links<\/td><td>Head-of-line stalls<\/td><td>Per-stream recovery<\/td><td>Meaningful gain<\/td><\/tr><tr><td>High-latency satellite\/VPN<\/td><td>Handshake cost per connection<\/td><td>0-RTT resumption<\/td><td>Large gain<\/td><\/tr><tr><td>Server CPU constrained<\/td><td>Lower cost<\/td><td>Higher per-packet cost<\/td><td>Keep HTTP\/2<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Common failure modes<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Symptom<\/th><th>Likely cause<\/th><th>Fix<\/th><\/tr><\/thead><tbody><tr><td>Only http\/1.1 negotiated<\/td><td>TLS 1.2 ciphers trimmed below AEAD set<\/td><td>Re-add ECDHE+AESGCM suites<\/td><\/tr><tr><td>h2 works, h3 never<\/td><td>UDP 443 blocked or provider filters UDP<\/td><td>Open UDP 443; otherwise accept h2<\/td><\/tr><tr><td>500 on HTTP\/2 only<\/td><td>Legacy ISAPI filter rejects streams<\/td><td>Disable HTTP\/2 on that binding<\/td><\/tr><tr><td>Static files fine, app slow<\/td><td>Multiplexing exposes app serialization<\/td><td>Profile app, not IIS<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A final note on sizing: HTTP\/3 adds a little CPU per connection because encryption is per-datagram, and QUIC connections live in kernel-side structures that need memory headroom. On a modest instance, compare the resource ceiling against what the host actually provisions \u2014 the tradeoffs are laid out in <a href=\"https:\/\/windows-vps.org\/windows-vps-comparison\/\">our Windows VPS comparison<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>HTTP\/2 is enabled by default on Windows Server 2016 and later, but HTTP\/3 is not, and both need specific registry keys to behave correctly behind a proxy or load balancer. This guide covers enabling HTTP\/3 over QUIC on IIS, verifying HTTP\/2 is actually negotiating, and the TLS cipher suites that must be present for either &#8230; <a title=\"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification\" class=\"read-more\" href=\"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/\" aria-label=\"Read more about Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":2,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-810","post","type-post","status-publish","format-standard","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification - Windows VPS Blog<\/title>\n<meta name=\"description\" content=\"HTTP\/2 is enabled by default on Windows Server 2016 and later, but HTTP\/3 is not, and both need specific registry keys to behave correctly behind a proxy\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification\" \/>\n<meta property=\"og:description\" content=\"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-28T02:07:56+00:00\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@myxiechengxuan\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/\",\"name\":\"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"datePublished\":\"2026-09-28T02:07:56+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"description\":\"HTTP\/2 is enabled by default on Windows Server 2016 and later, but HTTP\/3 is not, and both need specific registry keys to behave correctly behind a proxy\",\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\",\"https:\/\/x.com\/myxiechengxuan\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification - Windows VPS Blog","description":"HTTP\/2 is enabled by default on Windows Server 2016 and later, but HTTP\/3 is not, and both need specific registry keys to behave correctly behind a proxy","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/","og_locale":"en_US","og_type":"article","og_title":"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification","og_description":"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification","og_url":"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-09-28T02:07:56+00:00","author":"windows-vps","twitter_card":"summary_large_image","twitter_creator":"@myxiechengxuan","twitter_misc":{"Written by":"windows-vps","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/","url":"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/","name":"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"datePublished":"2026-09-28T02:07:56+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"description":"HTTP\/2 is enabled by default on Windows Server 2016 and later, but HTTP\/3 is not, and both need specific registry keys to behave correctly behind a proxy","breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/iis-http2-http3-windows-server-enablement\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Enabling HTTP\/2 and HTTP\/3 (QUIC) on IIS in Windows Server: Registry, Ciphers, and Verification"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog","https:\/\/x.com\/myxiechengxuan"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=810"}],"version-history":[{"count":1,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/810\/revisions"}],"predecessor-version":[{"id":815,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/810\/revisions\/815"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}